[{"data":1,"prerenderedAt":856},["ShallowReactive",2],{"page-\u002Frisk-assessment\u002Ffaq":3,"navigation":542},{"id":4,"title":5,"body":6,"description":16,"extension":535,"meta":536,"navigation":537,"path":538,"seo":539,"stem":540,"__hash__":541},"docs\u002F05.risk-assessment\u002F01.faq.md","FAQ and Troubleshooting",{"type":7,"value":8,"toc":506},"minimark",[9,13,17,22,27,35,49,53,60,64,68,74,78,84,88,98,102,106,113,117,123,127,132,136,142,146,151,155,165,169,173,193,197,200,222,229,233,261,265,268,464,468],[10,11,5],"h1",{"id":12},"faq-and-troubleshooting",[14,15,16],"p",{},"Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",[18,19,21],"h2",{"id":20},"refreshing-your-report","Refreshing your report",[23,24,26],"h3",{"id":25},"my-report-says-my-model-changed-what-do-i-do","My report says my model changed — what do I do?",[14,28,29,30,34],{},"Click ",[31,32,33],"strong",{},"Recreate",". A Risk Assessment is a point-in-time snapshot of your threat model as it stood when the report was generated. When the model's assessed structure changes afterwards, a banner tells you the report may no longer match — regenerating rebuilds every number against the model as it stands now.",[14,36,37,38,43,44,48],{},"The report never updates itself silently, so you always know whether the numbers on screen are current. See ",[39,40,42],"a",{"href":41},"\u002Frisk-assessment\u002Freading-the-report#staleness","Reading the Report"," for what the banner means and ",[39,45,47],{"href":46},"\u002Frisk-assessment\u002Fmethodology-and-trust#point-in-time","Methodology and Trust"," for why the report is a snapshot rather than a live scan.",[23,50,52],{"id":51},"the-banner-says-the-corpus-was-updated-but-nothing-looks-wrong","The banner says the corpus was updated, but nothing looks wrong.",[14,54,55,56,59],{},"Some update notices are advisory, not alarms. When the underlying ATT&CK\u002FD3FEND reference data changes in a way your assessment does not depend on, no coverage result in your report moved — only displayed details like technique names or reference links may be out of date. Recreate when convenient to pick up the current reference data. See ",[39,57,47],{"href":58},"\u002Frisk-assessment\u002Fmethodology-and-trust#freshness",".",[18,61,63],{"id":62},"scores-colors-and-honest-numbers","Scores, colors, and honest numbers",[23,65,67],{"id":66},"can-i-get-a-single-overall-risk-score","Can I get a single overall risk score?",[14,69,70,71,59],{},"No — and this is deliberate. Likelihood, impact, and severity are ordinal proxies drawn from your modeled structure, not probabilities or loss estimates, so collapsing them into one number would invent precision the model does not have. The report instead shows a prioritized worklist, a likelihood × impact matrix, and a coverage posture you can each trace back to your model. See ",[39,72,47],{"href":73},"\u002Frisk-assessment\u002Fmethodology-and-trust#no-single-score",[23,75,77],{"id":76},"why-is-there-no-green-no-all-clear","Why is there no green \u002F no \"all clear\"?",[14,79,80,81,59],{},"The report is honest by design: it would rather show a gap than a reassuring aggregate. Green reads as \"safe\", and a threat model can only tell you what it has drawn, not what is true in production — so the palette has no green anywhere, and \"covered\" or \"confirmed\" is shown in a positive cyan instead. Absent evidence is shown as absent, never rounded up to a confirmed pass. See ",[39,82,47],{"href":83},"\u002Frisk-assessment\u002Fmethodology-and-trust#no-green",[23,85,87],{"id":86},"why-does-coverage-show-a-count-instead-of-a-percentage","Why does coverage show a count instead of a percentage?",[14,89,90,91,94,95,59],{},"Because the denominator is honest. Coverage is reported as counts across four states — covered, partial, uncovered, and cannot-tell-yet — over the same population of your most severe (High and Critical) findings, so \"3 of 8\" means exactly that. A single percentage would have to fold the \"we cannot tell\" cases into one side or the other, turning an unknown into a false pass or a false gap. See ",[39,92,42],{"href":93},"\u002Frisk-assessment\u002Freading-the-report#coverage"," and ",[39,96,47],{"href":97},"\u002Frisk-assessment\u002Fmethodology-and-trust#coverage-denominator",[18,99,101],{"id":100},"the-risk-register","The risk register",[23,103,105],{"id":104},"i-authored-a-risk-but-the-matrix-didnt-change-is-that-a-bug","I authored a risk but the matrix didn't change — is that a bug?",[14,107,108,109,59],{},"No. The management risk register is separate from the computed analysis by design: authoring, editing, or deleting a risk never moves a computed number and never marks your report stale. The likelihood × impact matrix at the top of the report shows what the analysis derived from your model; your authored risks appear in their own risk matrix that shows up once you have an open risk in the register. See ",[39,110,112],{"href":111},"\u002Frisk-assessment\u002Fthe-risk-register#isolation","The Risk Register",[23,114,116],{"id":115},"a-risk-i-linked-now-shows-needs-review-why","A risk I linked now shows \"needs review\" — why?",[14,118,119,120,59],{},"Because a finding you cited as evidence has moved since you linked it. The register freezes each finding's severity as it read at link time, then compares it to the current report — so a row can flag \"changed since linked: HIGH → MEDIUM\", or note that the finding is gone or has been dispositioned. It is a marker for your attention, not an error, and nothing is auto-closed. A finding you personally affirmed stays live and will not flag. See ",[39,121,112],{"href":122},"\u002Frisk-assessment\u002Fthe-risk-register#evidence-liveness",[23,124,126],{"id":125},"a-risk-says-consider-closing-what-does-that-mean","A risk says \"consider closing\" — what does that mean?",[14,128,129,130,59],{},"Every finding behind that risk has been dispositioned or has dropped out of the current report, so there may be nothing left for the risk to track. It is a suggestion, not an instruction — review the risk and close it yourself if you agree. See ",[39,131,112],{"href":122},[23,133,135],{"id":134},"two-risks-show-the-same-reference-handle-is-that-a-problem","Two risks show the same reference handle — is that a problem?",[14,137,138,139,59],{},"It is rare and harmless. In the uncommon case where two risks are created in the same instant under the same prefix and day, they can receive the same reference handle. The handle is a convenience for GRC lookup, not the risk's identity — each risk still has its own permanent, unique internal identity, so nothing is confused or overwritten. See ",[39,140,112],{"href":141},"\u002Frisk-assessment\u002Fthe-risk-register#reference-handles",[23,143,145],{"id":144},"there-are-gaps-in-my-reference-numbers","There are gaps in my reference numbers.",[14,147,148,149,59],{},"That is normal. Reference handles are not a complete sequence and not a timeline — deleting a risk leaves its number unused, and a same-day delete-then-recreate can reuse one. Do not read the numbering as a count of risks or an order of importance. See ",[39,150,112],{"href":141},[23,152,154],{"id":153},"can-i-undo-a-deleted-risk","Can I undo a deleted risk?",[14,156,157,158,161,162,59],{},"No. Deletion is permanent — there is no version history, no recycle bin, and no way to recover a deleted risk. If you only want to take a risk off the active list, use ",[31,159,160],{},"Close"," instead: a closed risk is archived rather than destroyed and can be reopened. Delete only when you are certain. See ",[39,163,112],{"href":164},"\u002Frisk-assessment\u002Fthe-risk-register#status",[18,166,168],{"id":167},"reports-and-exports","Reports and exports",[23,170,172],{"id":171},"how-do-i-get-my-register-into-our-grc-tool","How do I get my register into our GRC tool?",[14,174,175,176,179,180,184,185,188,189,59],{},"Export the register as ",[31,177,178],{},"CSV"," and import that file into your GRC platform. The CSV is a flat, importable table with a stable column layout you can map once. When you use it as a join key, key on the risk id (",[181,182,183],"code",{},"risk_id",": stable, unique, never empty, and the second-to-last column, just before ",[181,186,187],{},"evidence_sources","), not the reference handle. See ",[39,190,192],{"href":191},"\u002Frisk-assessment\u002Fstakeholder-reports#register-csv","Stakeholder Reports",[23,194,196],{"id":195},"which-report-do-i-send-the-board-versus-the-risk-committee","Which report do I send the board versus the risk committee?",[14,198,199],{},"There are three audience tiers, all built from the same frozen numbers so they can never disagree:",[201,202,203,210,216],"ul",{},[204,205,206,209],"li",{},[31,207,208],{},"Board \u002F Executive"," — a one-page summary: the headline takeaway, the exposed-and-uncovered count, the matrix, and the top risks. Send this to the board.",[204,211,212,215],{},[31,213,214],{},"Risk Committee"," — the reconciliation view: coverage, the full limitations panel, finding-type summary, the complete register, and where authored risks and computed findings diverge. Send this to the risk committee.",[204,217,218,221],{},[31,219,220],{},"Technical"," — the complete report with every analyst appendix.",[14,223,224,225,228],{},"See ",[39,226,192],{"href":227},"\u002Frisk-assessment\u002Fstakeholder-reports#tiers"," for what each tier includes and omits.",[23,230,232],{"id":231},"is-my-authored-text-safe-when-the-csv-is-opened-in-excel","Is my authored text safe when the CSV is opened in Excel?",[14,234,235,236,239,240,239,243,239,246,249,250,253,254,257,258,59],{},"Yes. Any cell whose text begins with a character a spreadsheet might read as a formula (",[181,237,238],{},"=",", ",[181,241,242],{},"+",[181,244,245],{},"-",[181,247,248],{},"@",") is neutralized so it opens as plain text and cannot execute. Neutralizing adds a single leading apostrophe to those cells, so a value like ",[181,251,252],{},"-Smith"," exports as ",[181,255,256],{},"'-Smith"," — treat the exported value as authoritative, and strip that one leading apostrophe only if you are matching the reference handle exactly against another system. See ",[39,259,192],{"href":260},"\u002Frisk-assessment\u002Fstakeholder-reports#csv-safety",[18,262,264],{"id":263},"glossary","Glossary",[14,266,267],{},"Plain-language definitions of the terms used across this report. Each links to the guide that covers it in depth.",[269,270,276],"div",{"className":271,"tabIndex":273,"role":274,"ariaLabel":275},[272],"table-frame",0,"region","Table: Glossary",[277,278,279,292],"table",{},[280,281,282],"thead",{},[283,284,285,289],"tr",{},[286,287,288],"th",{},"Term",[286,290,291],{},"What it means",[293,294,295,309,321,335,348,361,374,390,402,414,426,439,452],"tbody",{},[283,296,297,303],{},[298,299,300],"td",{},[31,301,302],{},"Band",[298,304,305,306,59],{},"The qualitative severity label — Low, Medium, High, Critical, or Unscored — carried by findings and elements. Never a numeric score. See ",[39,307,42],{"href":308},"\u002Frisk-assessment\u002Freading-the-report#bands",[283,310,311,316],{},[298,312,313],{},[31,314,315],{},"Coverage posture",[298,317,318,319,59],{},"A four-state summary — covered, partial, uncovered, cannot-tell-yet — of how many of your most severe findings have a modeled control, shown as counts over a shared total. See ",[39,320,42],{"href":93},[283,322,323,328],{},[298,324,325],{},[31,326,327],{},"Finding",[298,329,330,331,59],{},"A single deterministic detection surfaced from your model — either a control gap or an architectural issue. There are ten types. See ",[39,332,334],{"href":333},"\u002Frisk-assessment\u002Ffindings","Findings",[283,336,337,342],{},[298,338,339],{},[31,340,341],{},"Zoning \u002F data-flow finding",[298,343,344,345,59],{},"A finding about how data crosses the trust zones you declared, judged against a policy on those zones (finding types F6–F10). See ",[39,346,334],{"href":347},"\u002Frisk-assessment\u002Ffindings#zoning",[283,349,350,355],{},[298,351,352],{},[31,353,354],{},"Treatment",[298,356,357,358,59],{},"The management decision recorded on a register risk: undecided, accept, mitigate, transfer, or avoid. See ",[39,359,112],{"href":360},"\u002Frisk-assessment\u002Fthe-risk-register#treatment",[283,362,363,368],{},[298,364,365],{},[31,366,367],{},"Disposition",[298,369,370,371,59],{},"A status recorded on a finding in the ledger, such as affirmed or risk-accepted. Distinct from a treatment, which sits on a register risk. See ",[39,372,42],{"href":373},"\u002Frisk-assessment\u002Freading-the-report#dispositions",[283,375,376,381],{},[298,377,378],{},[31,379,380],{},"Reference handle",[298,382,383,384,387,388,59],{},"The human-facing GRC lookup id on each register risk (for example ",[181,385,386],{},"DT-CS-260717-4","). A handle, not a ranking, and not the risk's stable identity. See ",[39,389,112],{"href":141},[283,391,392,397],{},[298,393,394],{},[31,395,396],{},"Evidence liveness",[298,398,399,400,59],{},"The per-risk check that compares each finding you cited as it reads now against how it read when you linked it. See ",[39,401,112],{"href":122},[283,403,404,409],{},[298,405,406],{},[31,407,408],{},"\"Needs review\"",[298,410,411,412,59],{},"The marker on a register risk whose linked evidence has moved, been dispositioned, or gone since you cited it. Informational — nothing is auto-closed. See ",[39,413,112],{"href":122},[283,415,416,421],{},[298,417,418],{},[31,419,420],{},"Staleness \u002F point-in-time",[298,422,423,424,59],{},"The report reflects your model at the moment it was generated; if the model changed since, a banner asks you to Recreate. See ",[39,425,42],{"href":41},[283,427,428,433],{},[298,429,430],{},[31,431,432],{},"Executive band",[298,434,435,436,59],{},"The summary block at the top of the report — the matrix, the coverage strip, and the takeaway line — that reads as one unit. See ",[39,437,42],{"href":438},"\u002Frisk-assessment\u002Freading-the-report#executive-band",[283,440,441,446],{},[298,442,443],{},[31,444,445],{},"Priorities",[298,447,448,449,59],{},"The ranked worklist that orders findings by promotion rules so the most acute work rises to the top. A rank, never a score. See ",[39,450,42],{"href":451},"\u002Frisk-assessment\u002Freading-the-report#priorities",[283,453,454,459],{},[298,455,456],{},[31,457,458],{},"The three report tiers",[298,460,461,462,59],{},"The Board \u002F Executive, Risk Committee, and Technical exports — the same frozen numbers filtered and framed for each audience. See ",[39,463,192],{"href":227},[18,465,467],{"id":466},"what-to-read-next","What to read next",[201,469,470,477,483,488,494,500],{},[204,471,472,476],{},[39,473,475],{"href":474},"\u002Frisk-assessment\u002Fgetting-started","Getting Started"," — generate your first report.",[204,478,479,482],{},[39,480,42],{"href":481},"\u002Frisk-assessment\u002Freading-the-report"," — the matrix, coverage, priorities, and bands.",[204,484,485,487],{},[39,486,334],{"href":333}," — the ten finding types explained.",[204,489,490,493],{},[39,491,112],{"href":492},"\u002Frisk-assessment\u002Fthe-risk-register"," — authoring risks, evidence, and treatments.",[204,495,496,499],{},[39,497,192],{"href":498},"\u002Frisk-assessment\u002Fstakeholder-reports"," — the audience tiers and exports.",[204,501,502,505],{},[39,503,47],{"href":504},"\u002Frisk-assessment\u002Fmethodology-and-trust"," — why the report under-claims.",{"title":507,"searchDepth":508,"depth":508,"links":509},"",3,[510,515,520,528,533,534],{"id":20,"depth":511,"text":21,"children":512},2,[513,514],{"id":25,"depth":508,"text":26},{"id":51,"depth":508,"text":52},{"id":62,"depth":511,"text":63,"children":516},[517,518,519],{"id":66,"depth":508,"text":67},{"id":76,"depth":508,"text":77},{"id":86,"depth":508,"text":87},{"id":100,"depth":511,"text":101,"children":521},[522,523,524,525,526,527],{"id":104,"depth":508,"text":105},{"id":115,"depth":508,"text":116},{"id":125,"depth":508,"text":126},{"id":134,"depth":508,"text":135},{"id":144,"depth":508,"text":145},{"id":153,"depth":508,"text":154},{"id":167,"depth":511,"text":168,"children":529},[530,531,532],{"id":171,"depth":508,"text":172},{"id":195,"depth":508,"text":196},{"id":231,"depth":508,"text":232},{"id":263,"depth":511,"text":264},{"id":466,"depth":511,"text":467},"md",{},true,"\u002Frisk-assessment\u002Ffaq",{"title":5,"description":16},"05.risk-assessment\u002F01.faq","Dhlf_sRtTuA-Hr5TnF1H6wQsk7xQIpB8pYWldVUtt-A",[543,598,633,688,721,751,766,836],{"title":544,"description":545,"path":546,"stem":547,"children":548,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[549,553,558,563,568,573,578,583,588,593],{"title":550,"path":546,"stem":551,"description":552},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":554,"path":555,"stem":556,"description":557},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":559,"path":560,"stem":561,"description":562},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":564,"path":565,"stem":566,"description":567},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":569,"path":570,"stem":571,"description":572},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":574,"path":575,"stem":576,"description":577},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":579,"path":580,"stem":581,"description":582},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":584,"path":585,"stem":586,"description":587},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":589,"path":590,"stem":591,"description":592},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":594,"path":595,"stem":596,"description":597},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":599,"description":600,"path":601,"stem":602,"children":603,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[604,608,613,618,623,628],{"title":605,"path":601,"stem":606,"description":607},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":609,"path":610,"stem":611,"description":612},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":614,"path":615,"stem":616,"description":617},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":619,"path":620,"stem":621,"description":622},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":624,"path":625,"stem":626,"description":627},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":629,"path":630,"stem":631,"description":632},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":634,"description":635,"path":636,"stem":637,"children":638,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[639,643,648,653,658,663,668,673,678,683],{"title":640,"path":636,"stem":641,"description":642},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":644,"path":645,"stem":646,"description":647},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":649,"path":650,"stem":651,"description":652},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":654,"path":655,"stem":656,"description":657},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":659,"path":660,"stem":661,"description":662},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":664,"path":665,"stem":666,"description":667},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":669,"path":670,"stem":671,"description":672},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":674,"path":675,"stem":676,"description":677},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":679,"path":680,"stem":681,"description":682},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":684,"path":685,"stem":686,"description":687},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":689,"description":690,"path":691,"stem":692,"children":693,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[694,697,702,706,711,716],{"title":689,"path":691,"stem":695,"description":696},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":698,"path":699,"stem":700,"description":701},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":42,"path":703,"stem":704,"description":705},"\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":707,"path":708,"stem":709,"description":710},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":712,"path":713,"stem":714,"description":715},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":717,"path":718,"stem":719,"description":720},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":722,"description":723,"path":724,"stem":725,"children":726,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[727,731,732,735,738,741,744,748],{"title":728,"path":724,"stem":729,"description":730},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":5,"path":538,"stem":540,"description":16},{"title":334,"path":333,"stem":733,"description":734},"05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":475,"path":474,"stem":736,"description":737},"05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":47,"path":504,"stem":739,"description":740},"05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":42,"path":481,"stem":742,"description":743},"05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":745,"path":498,"stem":746,"description":747},"Stakeholder Reports and Exports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":112,"path":492,"stem":749,"description":750},"05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":752,"description":753,"path":754,"stem":755,"children":756,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[757,761],{"title":758,"path":754,"stem":759,"description":760},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":762,"path":763,"stem":764,"description":765},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":767,"description":768,"path":769,"stem":770,"children":771,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[772,776,781,786,791,796,801,806,811,816,821,826,831],{"title":773,"path":769,"stem":774,"description":775},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":777,"path":778,"stem":779,"description":780},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":782,"path":783,"stem":784,"description":785},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":787,"path":788,"stem":789,"description":790},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":792,"path":793,"stem":794,"description":795},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":797,"path":798,"stem":799,"description":800},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":802,"path":803,"stem":804,"description":805},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":807,"path":808,"stem":809,"description":810},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":812,"path":813,"stem":814,"description":815},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":817,"path":818,"stem":819,"description":820},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":822,"path":823,"stem":824,"description":825},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":827,"path":828,"stem":829,"description":830},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":832,"path":833,"stem":834,"description":835},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":837,"description":838,"path":839,"stem":840,"children":841,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[842,846,851],{"title":843,"path":839,"stem":844,"description":845},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":847,"path":848,"stem":849,"description":850},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":852,"path":853,"stem":854,"description":855},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186042]